swarm: per-agent inference settings (model, effort, subagent_models) in KV

swarm-controller keeps each agent's inference settings in a new
`agent-inference` KV bucket, one key per agent, and is its only writer
(`GET`/`PUT`/`DELETE /api/agents/{name}/inference`; `swarmctl agent
inference get|set|clear`). Every field is optional. Each agent reads its
own key every 10 s through a direct-get grant on that key alone, and a
set `model` or `effort` replaces the Bus value, so the next turn runs on
it and the badge follows.

The swarm value is applied without persisting it: `Bus::set_model` and
`set_effort` are split into a persisting setter and a non-persisting
`apply_*`, and the poller uses the latter. Otherwise the swarm value
would overwrite `hyperhive-model`/`hyperhive-effort`, and clearing it, or
a restart, would no longer find the agent's own value. An unset field
changes nothing; a field cleared after being applied goes back to the
local value (`harness_state::local_model`/`local_effort`, the same
resolution `Bus::new` uses), read again at the clear.

`subagent_models` is validated, stored and shown by `get`; no agent
applies it yet.

Refs #5034

docs/swarm/schedules.md

@@ -132,8 +132,8 @@ Each prompt they answer with has `id`, `name`, `agents` (sorted), `body`,
 `next_fire_unix`: the next time on the prompt's grid, as of the moment the
 controller answers, `null` when paused or a one-shot whose time has passed.
 
-An agent's own queue credential grants exactly one subject in the swarm's
-JetStream: `$JS.API.DIRECT.GET.KV_agent-schedules.$KV.agent-schedules.<agent>`,
+An agent's own queue credential grants exactly one subject in this bucket:
+`$JS.API.DIRECT.GET.KV_agent-schedules.$KV.agent-schedules.<agent>`,
 the direct read of its own key. It can't read another agent's key, open or
 watch the bucket, or write to it. A KV watch would need a consumer, and a
 consumer create subject doesn't name a key, so granting one would let the